GraphQL-core versions from 3.3.0a3 up to but not including 3.3.1 contain a denial of service vulnerability caused by a memory leak during aborted validations. When a validation is aborted due to exceeding the max_errors limit, a shared ValidationAbortedError instance accumulates traceback frames, retaining memory indefinitely. This allows unauthenticated clients to cause memory exhaustion by sending documents with over 100 validation errors, potentially leading to out-of-memory kills. The issue is fixed in version 3.3.1 by creating a new error instance per aborted validation and clearing tracebacks.